{"kind": "product", "path": "vulns/debian-13/rust-wasmtime", "name": "rust-wasmtime", "product": "rust-wasmtime", "ecosystem": "Debian:13", "items": [{"id": "CVE-2026-115893", "noindex": false, "published": "2026-10-23T21:29:33.917Z", "modified": "2026-10-23T21:29:33.917Z", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.00432, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115893", "title": "Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction", "description": "Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm", "https://github.com/bytecodealliance/wasmtime/pull/14818", "https://github.com/bytecodealliance/wasmtime/pull/14819"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-115889", "noindex": false, "published": "2026-10-23T21:23:27.669Z", "modified": "2026-10-23T21:23:27.669Z", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.00454, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115889", "title": "Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation", "description": "Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm", "https://github.com/bytecodealliance/wasmtime/pull/12613", "https://github.com/bytecodealliance/wasmtime/pull/14818"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-115393", "noindex": false, "published": "2026-10-22T19:13:59.314Z", "modified": "2026-10-22T19:13:59.314Z", "cvss": 1, "cvss_vector": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00092, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115393", "title": "Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion", "description": "Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store APIs fail to validate that objects belong to the Store's Engine. Embedders mixing objects between Engines via Instance::new, StructRefPre::new, or Tag::new can trigger trampoline signature mismatches causing out-of-bounds stack writes, GC heap corruption, or panics.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9", "https://www.vulncheck.com/advisories/wasmtime-before-24.0.12-25.0.0-before-36.0.13-37.0.0-before-46.0.2-and-47.0.0-before-47.0.3-cross-engine-type-confusion", "https://nvd.nist.gov/vuln/detail/CVE-2026-115393"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-115392", "noindex": false, "published": "2026-10-22T19:13:58.512Z", "modified": "2026-10-22T19:13:58.512Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L", "severity": "high", "epss": 0.00242, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115392", "title": "Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes", "description": "Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any sandboxed directory can read and write any host-accessible file, and read-only guests may read host files via preexisting symlinks.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg", "https://www.vulncheck.com/advisories/wasmtime-before-24.0.13-25.0.0-before-36.0.14-37.0.0-before-46.0.3-and-47.0.0-before-47.0.4-sandbox-escape-via-trailing-slashes", "https://nvd.nist.gov/vuln/detail/CVE-2026-115392"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-115389", "noindex": false, "published": "2026-10-22T19:13:55.163Z", "modified": "2026-10-22T19:13:55.163Z", "cvss": 1, "cvss_vector": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00153, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115389", "title": "Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API", "description": "Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit. A malicious WebAssembly guest can return crafted values that allocate at least ~100x more host memory than tracked, causing denial of service.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr", "https://www.vulncheck.com/advisories/wasmtime-before-36.0.16-37.0.0-before-48.0.3-and-49.0.0-before-49.0.1-denial-of-service-via-val-api", "https://nvd.nist.gov/vuln/detail/CVE-2026-115389"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-115387", "noindex": false, "published": "2026-10-22T19:13:53.696Z", "modified": "2026-10-22T19:13:53.696Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00112, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115387", "title": "Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflow", "description": "Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains a denial of service vulnerability in wasmtime-wasi that allows guest WASI programs to panic the host via overflowing filesystem timestamps. Attackers can pass atim or mtim values whose sub-second field overflows the seconds field to path_filestat_set_times, fd_filestat_set_times, set-times, or set-times-at, crashing the host.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h", "https://www.vulncheck.com/advisories/wasmtime-before-36.0.16-37.0.0-before-48.0.3-and-49.0.0-before-49.0.1-host-panic-via-wasi-filesystem-timestamp-overflow", "https://nvd.nist.gov/vuln/detail/CVE-2026-115387"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-115386", "noindex": false, "published": "2026-10-22T19:13:52.931Z", "modified": "2026-10-23T15:00:52.816Z", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00197, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115386", "title": "Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir", "description": "Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation that copies uninitialized struct padding into guest memory. Guests with a preopened directory can list entries to receive three bytes of leftover host stack or heap memory per directory entry.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24", "https://www.vulncheck.com/advisories/wasmtime-before-36.0.17-37.0.0-before-48.0.4-and-49.0.0-before-49.0.2-memory-disclosure-via-fd-readdir", "https://nvd.nist.gov/vuln/detail/CVE-2026-115386"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-115381", "noindex": false, "published": "2026-10-22T19:13:49.244Z", "modified": "2026-10-22T19:13:49.244Z", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00212, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115381", "title": "Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes", "description": "Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configured. A malicious WebAssembly guest can request huge zero-filled writes, exhausting host memory and causing denial of service.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r", "https://www.vulncheck.com/advisories/wasmtime-before-36.0.17-37.0.0-before-48.0.4-and-49.0.0-before-49.0.2-unbounded-host-memory-allocation-via-sinkoutputstream-write-zeroes", "https://nvd.nist.gov/vuln/detail/CVE-2026-115381"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-115380", "noindex": false, "published": "2026-10-22T19:13:48.469Z", "modified": "2026-10-22T19:13:48.469Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00118, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115380", "title": "Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff", "description": "Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host work per subscription without consuming or checking fuel. Malicious guest modules can pass many subscriptions to force long-running host computation that ignores configured fuel limits.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm", "https://www.vulncheck.com/advisories/wasmtime-before-36.0.17-37.0.0-before-48.0.4-and-49.0.0-before-49.0.2-fuel-limit-bypass-dos-via-wasi-preview-0-poll-oneoff", "https://nvd.nist.gov/vuln/detail/CVE-2026-115380"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-58494", "noindex": false, "published": "2026-07-08T20:22:16.039Z", "modified": "2026-07-09T13:28:57.055Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "severity": "medium", "epss": 0.00171, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-58494", "title": "Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination", "description": "Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj", "https://github.com/bytecodealliance/wasmtime/commit/5ddfd5f1ef28f2041fa07d237ad0336e167b0e0c", "https://github.com/bytecodealliance/wasmtime/commit/7db94cdcf0c79cb3dfde884b534b653f2dd83367"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-54786", "noindex": false, "published": "2026-07-01T20:12:35.560Z", "modified": "2026-07-02T12:44:55.431Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L", "severity": "low", "epss": 0.00367, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-54786", "title": "Wasmtime: Leak in WASIp1 `fd_renumber` implementation", "description": "Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; versions 25.0.0 through those before  36.0.11; versions 37.0.0 through those before 44.0.3; and versions 45.0.0 and 45.0.1 contain a native implementation of WASIp1 which suffers from a leak in the fd_renumber function where the file descriptor being renumbered to is not properly closed. Wasmtime's implementation erroneously only updated the table of descriptors for WASIp1 and didn't update the underlying table of descriptors used by the host. This behavior means that while fd_renumber works correctly from a guest's perspective it ends up leaking resources in the host that ", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3p27-qvp9-27qf", "https://nvd.nist.gov/vuln/detail/CVE-2026-54786"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-47261", "noindex": false, "published": "2026-06-15T19:47:40.366Z", "modified": "2026-06-16T12:46:04.260Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.00357, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-47261", "title": "Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction", "description": "Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and FilePerms::READ without FilePerms::WRITE, this access control mechanism can be bypassed via the wasip2 descriptor.open-at or wasip1 path_open interfaces by opening a file with only the OpenFlags::TRUNCATE oflag. The root cause is that the clause handling OpenFlags::TRUNCATE in crates/wasi/src/filesystem.rs (Dir::open_at, lines 967–969) did not set open_mode |= OpenMode::WRITE;, which is later used for the access control check against FilePerms to determine whether opening the file is permitted; the si", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2r75-cxrj-cmph", "https://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.9", "https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.10"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-44216", "noindex": false, "published": "2026-05-14T14:54:32.975Z", "modified": "2026-07-28T12:04:48.026Z", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00319, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-44216", "title": "Wasmtime: Panic when allocating a table exceeding the size of the host's address space", "description": "Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p8xm-42r7-89xg", "https://access.redhat.com/security/cve/CVE-2026-44216", "https://bugzilla.redhat.com/show_bug.cgi?id=2477467"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-35195", "noindex": false, "published": "2026-04-09T18:55:56.467Z", "modified": "2026-04-13T15:38:27.294Z", "cvss": 6.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00216, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-35195", "title": "Wasmtime has an out-of-bounds write or crash when transcoding component model strings", "description": "Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory. These writes on the host could hit unmapped memory or could corrupt host data structures depending on Wasmtime's configuration. Wasmtime by default reserves 4GiB of virtual memory for a guest's linear m", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-394w-hwhg-8vgm", "https://nvd.nist.gov/vuln/detail/CVE-2026-35195"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-35186", "noindex": false, "published": "2026-04-09T18:54:48.760Z", "modified": "2026-04-13T20:18:21.954Z", "cvss": 6.1, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00214, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-35186", "title": "Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backend", "description": "Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug where translating the table.grow operator causes the result to be incorrectly typed. For 32-bit tables this means that the result of the operator, internally in Winch, is tagged as a 64-bit value instead of a 32-bit value. This invalid internal representation of Winch's compiler state compounds into further issues depending on how the value is consumed. The primary consequence of this bug is that bytes in the host's address space can be stored/read from. This is only applicable to the 16 bytes before linear", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-f984-pcp8-v2p7", "https://nvd.nist.gov/vuln/detail/CVE-2026-35186"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-34988", "noindex": false, "published": "2026-04-09T18:52:26.131Z", "modified": "2026-04-09T19:31:07.544Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "severity": "low", "epss": 0.00286, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-34988", "title": "Wasmtime leaks data between pooling allocator instances", "description": "Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator contains a bug where in certain configurations the contents of linear memory can be leaked from one instance to the next. The implementation of resetting the virtual memory permissions for linear memory used the wrong predicate to determine if resetting was necessary, where the compilation process used a different predicate. This divergence meant that the pooling allocator incorrectly deduced at runtime that resetting virtual memory permissions was not necessary while compile-time determine that virtual m", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-6wgr-89rj-399p", "https://nvd.nist.gov/vuln/detail/CVE-2026-34988"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-34987", "noindex": false, "published": "2026-04-09T18:48:33.552Z", "modified": "2026-04-10T14:12:55.374Z", "cvss": 9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00278, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-34987", "title": "Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access", "description": "Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-memory sandbox. This vulnerability requires use of the Winch compiler (-Ccompiler=winch). By default, Wasmtime uses its Cranelift backend, not Winch. With Winch, the same incorrect assumption is present in theory on both aarch64 and x86-64. The aarch64 case has an observed-working proof of concept, while the x86-64 case is theoretical and may not be reachable in practice. This Winch compiler bug can allow th", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xx5w-cvp6-jv83", "https://nvd.nist.gov/vuln/detail/CVE-2026-34987"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-34983", "noindex": false, "published": "2026-04-09T18:47:26.575Z", "modified": "2026-04-13T15:38:33.779Z", "cvss": 1, "cvss_vector": "CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00117, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-34983", "title": "Wasmtime has a use-after-free bug after cloning `wasmtime::Linker`", "description": "Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be triggered by a specific sequence of embedder API calls made by the host. Specifically, the following steps must occur to trigger the bug clone a wasmtime::Linker, drop the original linker instance, use the new, cloned linker instance, resulting in a use-after-free. This vulnerability is fixed in 43.0.1.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hfr4-7c6c-48w2", "https://nvd.nist.gov/vuln/detail/CVE-2026-34983"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-34971", "noindex": false, "published": "2026-04-09T18:45:44.819Z", "modified": "2026-07-15T01:03:31.309Z", "cvss": 9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00319, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-34971", "title": "Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift", "description": "Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on aarch64 when performing a certain shape of heap accesses which means that the wrong address is accessed. When combined with explicit bounds checks a guest WebAssembly module this can create a situation where there are two diverging computations for the same address: one for the address to bounds-check and one for the address to load. This difference in address being operated on means that a guest module can pass a bounds check but then load a different address. Combined together this enables an ar", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jhxm-h53p-jm7w", "https://access.redhat.com/security/cve/CVE-2026-34971", "https://bugzilla.redhat.com/show_bug.cgi?id=2457008"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-34946", "noindex": false, "published": "2026-04-09T18:43:39.137Z", "modified": "2026-04-09T19:33:33.709Z", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00358, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-34946", "title": "Wasmtime's host panics when Winch compiler executes `table.fill`", "description": "Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a vulnerability where the compilation of the table.fill instruction can result in a host panic. This means that a valid guest can be compiled with Winch, on any architecture, and cause the host to panic. This represents a denial-of-service vulnerability in Wasmtime due to guests being able to trigger a panic. The specific issue is that a historical refactoring changed how compiled code referenced tables within the table.* instructions. This refactoring forgot to update the Winch code paths associated as well, meaning tha", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q49f-xg75-m9xw", "https://nvd.nist.gov/vuln/detail/CVE-2026-34946"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}]}], "total": 34, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "rust-wasmtime", "path": "vulns/debian-13/rust-wasmtime", "ecosystem": "Debian:13"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 9, "kev": 0}, "lastmod": "2026-10-23T21:29:33.917Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}